App Developers Increasingly Targeted via Slack, DevOps Tools
Slack, Docker, Kubernetes, and other applications that allow developers to collaborate have become the latest vector for software supply chain attacks.
Developers are increasingly under attack through the tools that they use to collaborate and to produce code — such as Docker, Kubernetes, and Slack — as cybercriminals and nation-state actors aim to access the valuable software that developers work on every day.
For instance, an attacker claimed on Sept. 18 to have used stolen Slack credentials to access and copy more than 90 videos representing the
early development of Grand Theft Auto 6
, a popular game from Take-Two Interactives Rockstar Games. And a week earlier, security firm Trend Micro discovered that attackers were systematically searching for and attempting to compromise misconfigured Docker containers.
Neither attack involved vulnerabilities in the software programs, but security missteps or misconfiguration are not uncommon on the part of developers, who often fail to take the care necessary to secure their attack surface area, says Mark Loveless, a staff security engineer at GitLab, a DevOps platform provider.
A lot of developers dont think of themselves as targets because they are thinking that the finished code, the end result, is what attackers are going after, he says. Developers often take security risks — such as setting up test environments at home or taking down all the security controls — so they can try out new things, with the intent of adding security later.
He adds, Unfortunately, those habits become replicated and become culture.
Attacks against the software supply chain — and the developers who produce and deploy software — have grown quickly in the past two years. In 2021, for example, attacks that aimed to compromise developers software — and the open source components widely used by developers — grew by 650%, according to the
2021 State of the Software Supply Chain
report, published by software security firm Sonatype.
Overall, security experts maintain that the fast pace of continuous integration and continuous deployment environments (CI/CD) that form the foundations of DevOps-style approaches pose significant risks, because
they are often overlooked
when it comes to implementing hardened security.
This affects a variety of tools used by developers in their efforts to create more efficient pipelines. Slack, for example, is the most popular synchronous collaboration tools in use among professional developers, with Microsoft Teams and Zoom coming in a close second and third, according to
the 2022 StackOverflow Developer Survey
. In addition, more than two-thirds of developers use Docker and another quarter use Kubernetes during development, the survey found.
Breaches of tools like Slack can be nasty, because such tools often perform critical functions and usually only have perimeter defenses, Matthew Hodgson, CEO and cofounder of messaging-platform Element, said in a statement sent to Dark Reading.
Slack is not end-to-end encrypted, so it’s like the attacker having access to the company’s entire body of knowledge, he said. A real fox-in-the-henhouse situation.
Cyberattackers, it should be noted, dont just probe for misconfigurations or lax security when it comes to going after developers. In 2021, for example, a threat groups access to Slack through the
gray-market purchase of a login token
led to a breach of game giant Electronic Arts, allowing the cybercriminals to copy nearly 800GB of source code and data from the firm. And a 2020 investigation into Docker images found that
more than half of the latest builds
have critical vulnerabilities that put any application or service based on the containers at risk.
Phishing and social engineering are also plagues in the sector. Just this week, developers using two DevOps services — CircleCI and GitHub — were
targeted with phishing attacks
.
And, there is no evidence that the attackers targeting Rockstar Games exploited a vulnerability in Slack — only the claims of the purported attacker. Instead, social engineering was likely way to bypass security measures, a Slack spokesperson said in a statement.
Enterprise-grade security across identity and device management, data protection, and information governance is built into every aspect of how users collaborate and get work done in Slack, the spokesperson said, adding: These [social engineering] tactics are becoming increasingly common and sophisticated, and Slack recommends all customers practice strong security measures to guard their networks against social engineering attacks, including security awareness training.
Developers have only slowly accepted security as application security professionals call for better controls, however. Many developers
continue to leak secrets
— including passwords and API keys — in code pushed to repositories. Thus, development teams should focus on not just protecting their code and preventing the importing of untrusted components but also ensuring that the critical capabilities of their pipelines are not compromised, GitLabs Loveless says.
The whole zero-trust part, which is typically about identifying people and things like that, there also should be the same principles that should apply to your code, he says. So dont trust the code; it has to be checked. Having people or processes in place that assumes the worst — Im not going to trust it automatically — particularly when the code is doing something critical, like build a project.
In addition, many developers still do not use basic measures to strengthen authentication, such as using multifactor authentication (MFA). There are changes afoot, however. Increasingly, the various open source software package ecosystems have all started
requiring that major projects adopt multifactor authentication
.
In terms of tools to focus on, Slack has gained attention because of the latest major breaches, but developers should strive for a baseline level of security control across all of their tools, Loveless says.
There are ebbs and flows, but it is whatever works for the attackers, he says. Speaking from my experience of wearing all kinds of hats of different colors, as an attacker, you look for the easiest way in, so if another way becomes easier, then you say, I will try that first.
GitLab has seen this follow-the-leader behavior in its own bug bounty programs, Loveless notes.
We see when people send in bugs, all the sudden something — a new technique — will become popular, and a whole slew of submissions resulting from that technique will come in, he says. They definitely come in waves.
Tags:
App Developers Increasingly Targeted via Slack, DevOps Tools